Practical Lab Environment Purpose Built to Span the Full Range of ICS/OT Communications
CyRenLAB is the only laboratory environment purpose-built to span the full range of ICS/OT communications, analog, serial, and IP, in a single modular platform. Other ICS labs cover the IP layer alone, leaving out the analog measurements and serial data streams that most industrial processes actually run on. CyRenLAB provides complete protocol and network coverage from Level 0 to Level 3.
Designed for NOC/SOC operators, researchers, forensic and incident responders, and educators, CyRenLAB provides a full spectrum real-world industrial environment versus just simulated IP networks. CyRenLAB enables hands-on activities in continuous monitoring and detection, baseline development, incident response, threat simulation, and industrial protocol research from Level 0 to Level 3.
The Problem: Significant Gaps in ICS/OT Readiness
- Gaps in protocol visibility across serial, analog, and IP communications
- Lack of data normalization and curation from Level 0 through Level 5
- No access to safe, full spectrum realistic environments for training or testing
- Inability to simulate threats across multiple levels of the Purdue Model
- Risk of disrupting production systems
These issues delay detection readiness, increase risk exposure, weaken response coordination across operation, and increase resource requirements for cybersecurity teams.
The Solution: CyRenLAB
CyRenLAB addresses these gaps by delivering a platform that is representative of realistic industrial control system architectures without risking live infrastructure and operations. CyRenLAB provides training, simulation, testing, and R&D across ICS networks, protocols and device types, enabling:
- Continuous monitoring, detection and baselining
- Incident response training
- Cyber-physical scenario validation
- Detection activities including anomaly reproduction and forensic data analysis
- Data normalization, curation, and contextualization for data analysis and AI/ML integration
- Adversarial and exploit testing and validation
CyRenLAB generates high-fidelity operational data for use in detection, operational and security analytics, baseline modeling, training and integration for Machine Learning and Artificial Intelligence platforms.
Key Capabilities
Full Stack ICS Protocol Support
Supports analog (4–20mA), serial, and IP protocols including Modbus, IEC 101/104
Multi-Level Support
Spans the full ICS stack, Level 0 to Level 3, on real hardware
Secure Testing
Train, validate, and test without risking live production environments
Real Devices
Hardware-in-the-loop with SCADA controllers, drives, meters, and sensors
What Teams Use It For
Train and Respond
- Protocol training, Levels 0 to 3
- Incident response tabletop exercises
- Baseline development
- Continuous diagnostics and monitoring
Test and Validate
- Threat simulation and validation
- Patch testing and validation
- Detection thresholds and alert logic
- Security testing before production
Investigate and Research
- Cyber-physical forensics and root cause
- Tailored anomaly detection
- AI/ML model development
- Industrial protocol research
Detection and Forensic Analysis of Man-in-the-Middle (MitM) Attacks on Serial Communications
Early Detection of Sensor Drift or Analog Signal Degradation
Training Anomaly Detection Models Using Multi-Protocol ICS Baseline Data
Benefits
Safe to break
Run the attack, not the risk
Every exploit scenario runs against equipment that exists to be attacked, so nothing you do can reach a production system.
Levels 0 to 3
Field devices to control network
Recreate an incident the way it unfolds, from a current loop in the field to a controller on the network.
Legacy and modern
Analog, serial, and Ethernet in one platform
The protocols in most plants are decades old and still running. CyRenLAB carries both, not just the ones that are easy to capture.
Professional Services
Training is delivered in person at your site, at a host facility, or live remote. The choice is yours.
Instructor-led training, on site
Our instructors bring CyRenLAB to your facility. Three days, twelve hands-on labs, no prerequisites.
Environment customization
CyRenLAB configured to mirror your architecture, protocols, and device mix for validation or research.
Live remote access
Run the same curriculum against a Cynalytica-hosted lab. Real hardware, real traffic, no shipping.
Bring Full ICS/OT Visibility to Your Team. Start Today!
| Specification | Value |
|---|---|
| Level 3 — Operations | |
| Server | Industrial PC |
| Server software | Cynalytica AnalytICS Engine |
| Controller | Programmable Automation Controller |
| Network | Industrial Ethernet switch (×2) |
| Gateway | Ethernet to serial |
| Monitoring sensor | Cynalytica OTNetGuard with IP module |
| Level 2 — Supervisory | |
| Monitoring sensors | Cynalytica OTNetGuard / SerialGuard with RS-485/422 module |
| Power monitor | IEC 60870-5-104 communications |
| Tower light | 5 segment |
| Level 1 — Control | |
| Controller | Programmable Automation Controller |
| Power monitor | IEC 60870-5-101 communications |
| Monitoring sensor | Cynalytica OTNetGuard with RS-485/422 module |
| Variable speed drives | DC brushless drives with Modbus RTU communications (×2) |
| Level 0 — Process | |
| Monitoring sensors | Cynalytica OTNetGuard with 4–20 mA input (×2) |
| DC brushless motors | 24 VDC, 5000 RPM (×2) |
| Digital inputs | 24 VDC in (×2) |
| Analog inputs | 4–20 mA (×2) |
| Front-panel controls | Manual analog adjustment for inflow and outflow |
| Protocols | |
| Analog | 4–20 mA current loop |
| Serial | Modbus RTU, IEC 60870-5-101 |
| Ethernet | Modbus TCP, IEC 60870-5-104 |
| Purdue coverage | Level 0 through Level 3 |
| Physical and power | |
| Dimensions (H × W × D) | 800 × 635 × 483 mm (31.5 × 25.0 × 19.0 in) |
| Weight | Approximately 25 kg (55 lb) |
| Power supply | 120 VAC to 240 VAC |
| Current draw | 2 A at 120 V, 1 A at 240 V |
| Included | |
| Documentation | Instructional workbook and lab exercises |
| Query language | CyRenQL for dashboards, widgets, and detection rules |
| Exercise tooling | OWL (Offensive Workload Launcher) for scenario execution |
| Data export | JSON and CSV |